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egta is the trade association of television and radio sales houses that commercialise the advertising 
space of both private and public TV/radio channels all over Europe. 


e 87TV members and 34 Radio members 

e 28 European countries including 23 EU Member States 

e More than 75% of the European TV advertising market and 50% of radio advertising market in 
countries represented by the egta members 


egta and its members welcome the opportunity to revise and improve the EU’s general data protection 
framework. This position paper sets out the views and primary concerns about the proposal for a 
General Data Protection Regulation. 


Why does data protection matter for sales houses? As sales houses commercialise the advertising space 
for TV and radio channels, new technologies affecting advertising are of utmost concern. Advertising in 
its new forms plays a significant role in the development of the internet and comparable to traditional 
media; it is the business model for making (non-publicly funded) content widely available to EU citizens 
for little or no cost. In order to maintain this growth, processing data is vital to allow advertising to be 
tailored towards the consumer. 


Developments in the field of media and advertising (connected devices, Connected TV, online social 
networks etc) including significant increases in the exchange and use of data - mean that there is a need 
to review and update data protection rules across Europe. Therefore egta welcomes the chance to 
streamline these rules, reducing the burdens on businesses and allowing broadcasters to collect and 
process personal data, thus permitting them to provide their services on new platforms and devices. 


egta appreciates and recognises the need to update the current rules on data protection as both citizens 
and businesses will benefit from the responsible use of online data, especially for online behavioural 
advertising (OBA). However while the proposal from the commission clarifies certain aspects of the 
current Data Protection Directive, it goes too far and is unclear in some areas. Importantly the draft text 
changes several definitions already contained in existing EU law, such as the e-privacy directive, which is 
currently being implemented into national law. The proposed text could overrule national interpretations 
of definitions, for example by adding “explicit” to the idea of consent. The amount of rules has increased 
significantly since the data protection directive and will certainly complicate the day to day business of 
sales houses that use personal data for commercial purposes, such as OBA for example. 


For sales houses, the main concerns from a marketing perspective that will have an adverse impact on 
the industry are the definition of personal data, the notion of consent and the age of a child. 


Personal data (article 4 (2)): In the Commission’s proposal, ‘Personal data’ means ‘any information 
relating to a data subject’. egta believes this definition is too wide-ranging and does not differentiate 
between sensitive, personally identifiable and anonymous data and therefore places a disproportionate 
burden on businesses that wish to use this data and provide services such as OBA. For instance, the 
proposed Regulation does not distinguish between the use of data to directly identify an individual and 
the use of data that is unique to a device such as an IP address but does not directly identify an 
individual. 


Therefore egta recommends making a distinction between three types of data: non-personally 
identifiable data; personal data (allowing identification of a specific individual); and sensitive data. 


Consent (article 4.8 and 7). The issue of consent is an important one for sales houses that use personal 
data for targeted advertising. egta believes that the requirement to obtain explicit consent for 
processing personal data overlooks a contextual and consumer-friendly approach. The practice is both 
difficult to implement and creates a burden on the business while creating a cumbersome online 
experience for users. As with ‘personal data’, the proposal does not make the difference between 
categories, for example ‘cookies’ and the risk is that we might end up creating explicit consent fatigue 
(through consumers having to tick boxes on every site). 


The draft Regulation indicates in Article 19 and Recital 57 that "where personal data are processed for 
direct marketing purposes, the data subject shall have the right to object free of charge the processing 
of their personal data for such marketing. This right shall be explicitly offered to the data subject..." In 
that sense, this provision clearly favours an opt-out approach (as opposed to an opt-in solution based on 
prior user consent). These provisions are certainly relevant for those broadcasters that undertake online 
advertising by either collecting data on users' web-viewing behaviour on their own websites or selling 
part of their online inventory to one or more advertising networks and handing over the process to 
them. 


In the realm of consent, the issue of parental consent (article 8) raises many concerns about children, 
privacy and targeted advertising. According to the draft proposal, collection and processing of personal 
data of a child below the age of 13 years by providers of information services directed to children shall 
only be lawful if consent is given or authorised by the child's parent or custodian. 


egta welcomes this suggestion as it gives parents more control over their children’s personal data 
while still letting the industry offer entertainment, information and social networking opportunities to 
that age group. It should be noted that in self-regulatory initiatives such as the European Advertising 
Standards Alliance Best Practice Recommendation (BPR) on Online Behavioural Advertising, the age that 
companies agree not to create segments for OBA purposes that are specifically designed to target 
children is people age 12 and under. 


Definition of a child (article 4 (18)): According to the Commission proposal, a 'child' is defined as any 
person below the age of 18 years. In defining a child as aged 18 and under, the draft regulation does not 
differentiate between the differing abilities and understanding of older teenage viewers, as opposed to 
younger children. There is no other definition of a ‘child’ in EU law, and blanket provisions applying to an 
age group spanning from 6 year old children to 17 year old teenagers are likely to be ineffective. egta 


recognises that while the intention as highlighted in recital 29, is to provide ‘specific protection of the 
personal data of children’, there needs to be a balance between the protection of processing/using 
children’s data and not preventing the media from engaging with young audiences, particularly regarding 
public service content and services which are specially designed for young children. 


e Agree with the proposed requirement for parental consent in relation to children aged 12 and 
under, but recommend that detailed provisions for obtaining parental consent be established 
through standards developed in agreement with economic operators, rather than delegated or 
implementing acts, as currently proposed. 

e Suggest that, should they be deemed necessary, other specific provisions on children be 
defined on a case-by-case basis, not relying on a one-size-fits-all definition of children. 


Recognition of self-regulation in this field: egta would like to highlight that alternatives to legislation, 
such as co-regulation and self-regulation, should be considered to help achieve the objectives of some of 
the provisions of the draft Regulation. As an example, the recently launched European Interactive Digital 
Advertising Alliance (EDAA), of which egta is a board member, is a NGO set up by the European 
advertising industry to provide transparency, choice and control to consumers when it comes to online 
privacy. 


This body has two primary roles: 

e the EDAA will ensure that companies who wish to practice OBA within Europe can apply for an 
annual ‘OBA licence’ which would provide them with the use of an OBA ‘icon’ (a registered 
trademark) to be displayed on online ads; 

e the EDAA will primarily be responsible for licensing the icon and, in due course, deciding on the 
selection, accreditation and oversight of the compliance monitoring bodies. 


egta is also a signatory of the European Advertising Standards Alliance Best Practice Recommendation 
(BPR) on Online Behavioural Advertising which expresses that Third Parties should not create segments 
that are specifically designed to target children using Online Behavioural Advertising. The BPR does not 
restrict the collection of OBA data for the purpose of marketing children’s products to parents and other 
adults. 


Based on these actions, egta calls on the Commission to encourage stakeholders to implement certain 
provisions by means of self-regulation, and give a clear authorization to economic operators to 
develop effective, enforceable standards in consultation with the European Commission. 


In conclusion, egta recommends: 

e Making a distinction between three types of data: non-personally identifiable data; personal 
data (allowing identification of a specific individual); and sensitive data. 

e Having a consumer-friendly and opt-out approach for consent regarding the placement of 
cookies. There should be a consistent approach to this in regulatory instruments. 

e That detailed provisions for obtaining parental consent be established through standards 
developed in agreement with economic operators. 

e Due recognition of the effectiveness of self-regulation in the field of data protection and calls on 
the Commission to encourage stakeholders to implement certain provisions by means of self- 
regulation. 


